Access Control CSE 465 – Information Assurance Fall 2017 Adam Doupé Arizona State University http://adamdoupe.com

Example A university’s academic integrity policy disallows cheating Includes copying homework, with or without permission CSE class has students do homework on a shared server (similar to general.asu.edu) Student A forgets to read-protect homework file Student B copies the file Who did something wrong?

Authorization What can you do on the system? Vs. Authentication (we will cover later) Who are you?

Authorization, Trust, and Risk Need to manage Authorization Trust To manage risk Can you eliminate risk?

Authorization vs. Access Control Authorization is the policy Access Control is the mechanism

Modeling Access Control Subjects S Things in the system that can act Objects O Assets or objects in the system (acted upon) Rights R What can the subject do to the object?

Access Matrix Model F G U V r1, r2 r2 r4 r2, r3 r5, r6

Simplified UNIX Model Subjects are processes Files are objects p, q Files are objects f, g Rights (read, write, execute, append, own) r, w, x, a, o

Access Control Matrix Model f g p q rwo r rwxo w a ro

Access Control Matrix Benefits Drawbacks

Implementation How to implement Access Control Matrix?

Access Control Lists (ACLs) Each column of the access matrix is stored with the object f p: rwo q: a g p: r q: ro

Capability Lists Each row of the access matrix is stored with the subject p f: rwo g: r q f: a g: ro

Relation Subject Access Object p r f w o g q a

ACL vs. Capability ACL requires authentication of subjects CAP does not require authentication of subjects Capabilities must be unforgeable and propagation must be controlled

ACL vs. Capability Per-Object basis File a File b Per-Subject basis User: rights . User: rights . /project File c File b File a Per-Subject basis user Rights: File a, Rights: Fila b

ACL vs. Capability Least Privilege CAP provides for finer grained least privilege control with respect to subjects, especially dynamic short-lived subjects created for specific tasks

ACL vs. Capability Access review Revocation ACL better for access review of objects CAP better for access review of subjects Revocation ACL better for revocation on object basis CAP better for revocation on subject basis

Capability Lists: Granting Access p wants to grant q read access to file f How to do this? p f: rwo g: r q f: a g: ro q f: ar g: ro q f: a g: ro f: r

UNIX ACL 12 permission bits for each file, logically grouped into 4 sets of three bits each _ _ _ _ _ _ _ _ _ _ _ _ first 3 bits: SUID SGID Sticky-bit next 3 bit sets apply to file’s owner, users in file’s group and all users respectively read write execute sticky bit set on a directory means that people can create files in the directory but cannot write or rename other directories. Not relevant to files (come from old UNIX where it would keep the program in memory. ls -la does execute as x for execute, s for means that x is set and setuid is set, S means that x is not set and setuid is set, t (only on other bit) implies sticky bit and executable, T sticky bit is set but other is not executable

Other Access Control Ideas Content dependent controls You can only see salaries less than 50K You can only see salaries of employees who report to you Context dependent controls Cannot access sensitive information from a remote login Salary information can be updated only at year end Company’s earnings report is confidential until announced at the stockholder’s meeting

Types of Access Control Discretionary Access Control Owner of the object controls who can access the object Mandatory Access Control System controls access to an object Originator Controlled Access Control Originator of the object controls who can access the object

Mandatory Access Control Security Levels Security Category Security Labels

Security Levels Many organizations have hierarchical relationship between security sensitivity of assets One file might have the highest security sensitivity Office environments: memos, reports, customer lists, backup data Defined sensitivity and importance

Security Levels Need some way to tag data on a computer system Associate a security level with each entity What type of relationship? 1-1? 1-*?

Examples Military Security Levels Commercial Security Levels Top Secret Secret Confidential Unclassified Commercial Security Levels Restricted Proprietary Sensitive Public

Policy What policy do we want our MAC to enforce? Let’s use the military example Top Secret Secret Confidential Unclassified

Notation L(S) = ls is the security clearance of subject S L(O) = lO is the security classification of object O For all security classifications li,i=0, …, k-1, li < li+1

Security Conditions Simple-Security Condition (preliminary version) S can read O iff lO ≤ lS *-Property (preliminary version) S can write O iff lS ≤ lO

Examples Military Security Levels Commercial Security Levels Write Military Security Levels Top Secret Secret Confidential Unclassified Commercial Security Levels Restricted Proprietary Sensitive Public Read

Security Categories Security levels are too fine-grained Categories NUC NATO ACE Need-to-know basis for assigning categories to subjects How to define the security policy now?

Notation A subject’s security level and object’s security level is now (L, C), where L is the level and C is the set of categories How to compare subject S1 with object O1 for access?

Lattice {NUC, NATO, ACE} {NUC, NATO} {NUC, ACE} {NATO, ACE} {NUC} {}

Bell-LaPadula Model The security level (L, C) dominates the security level (L’, C’) iff L’ ≤ L and C’ ⊆C Simple-Security Condition S can read O iff S dom O *-Property S can write to O iff O dom S

Examples A has TS, {ACE} B has S, {NATO, ACE} Can A Can B Read TS, {} Write S, {ACE} Read TS, {NATO, ACE} Write TS, {ACE, NATO} Can B Write S, {NATO} Read S, {ACE, NUC} Write U, {}

Other Types of Access Control Role Based Access Control (RBAC) User’s permissions are determined by the user’s role Rather than identity (DAC) or clearance (MAC) More natural expression of business logic Attribute Based Access Control (ABAC) Users have attributes (age, ID number, group membership, etc.) Policy is a complex Boolean expression on the attributes

Research in Access Control Usability Flexibility Expressiveness Federation